BuddyPress.org

Reality is that you would have to be proactive in killing those spam robots and human spammers if you have open registration. Search through BP.org shows many threads which share tips in plugins to use to prevent this and not all are 100% perfect since these spammers are really gung-ho about overcoming such preventions. Having said that, check out this thread – https://buddypress.org/community/groups/how-to-and-troubleshooting/forum/topic/has-anyone-tried-this-spammer-blocking-plugin-with-buddypress/

I am currently writing my own theme that looks nothing like BP-default, but I’ve been on trac almost daily with the UI tickets. I don’t know if we need a dedicated “UI/UX” team, but as long as folks are submitting on those tickets it will ease some of the other dev’s needing to mess with it. I DO think it is an important component with BP and we need to keep talking about 1.3’s problems.

I’m glad to see all the discussion going on, especially in light of all the “BP IS DEAD” nonsense. I think the biggest issue is how the forums make it hard to actually talk, but the testBP forums are great and I’m excited to see them go live here. I’m also anxious to see the new BP.org which seems to be slated to June.

My biggest issue with the BP sites I run is spam. Even my non indexed test servers get spammed. My AIGA site was deleting 250 spam users/blogs a day before shutting off new user registration. The first part of that comes from spam users being registered. There are two types of spam services, bots, and (slave) labor. These folks get through the Captcha’s and set up real fake accounts. But in my experience with my comment forms adding a Captcha killed a vast majority of spamers. Then with comments, contact forms, etc this would kill most spam. From there heuristic spam fighting from splogs, comments, etc. Also a system that users can mark a item as spam would help a ton.

Second, its that to learn how to do ANYTHING in BP I have to take something that works with the current version and hack it a part to figure out basic commands and actions. Once the new site is up I think there should be a real push on getting the Codex up to snuff(look at jQuery and WP) that have examples, resources, etc. Then have tutorials on things, hell syndicate them from other bloggers.

So as my thing(s) I want to keep being a part of fixing UI issues, and will as long as I can.
I want to write for the Codex, and am here and willing to write Blog articles for BP. Tutorials, Updates, whatever. I’m game. I will be writing tutorials for AIGA members anyway, so why not sync the content here.
I am working on the Group Documents plugin with its original developer because my sites need it.

And lastly I will be writing a BP-Spam component. I will do it as a plugin first and will want/need tons of feedback. But to get the University to sign off on my project I will need to stop all the Viagra and other inappropriate content from making it through. I will do this regardless of it being a part of BP but want to give back however I can.

I’m so psyched to see all the energy is still in this project!

These automated bots are usually just that, automated that are programmed to look for specific strings in search engines that return a list of buddypress sites and then harvested. I was getting hammered with 20+ blogs getting created a day that was spam. I tried ever plugin and .htaccess tricks known to man and none of them worked. I was tired of all of the spam I was getting so I put on my tin foil and went to war. I was determined to win this war and to stop 99.9% of automated spam dead in its tracks.
First I went to cpanel and under the “Website Traffic” on the left side of the page and clicked “View all traffic” then clicked on my domain name.

When the statistics page for that domain loaded I looked on the left hand side of the page for “Search Keyphrases”, this will show me a list of the keyphrases that was used to find my site.

I found all the keyphrases that was used by the spammers to find my site in the search engines and here is the list of the keyphrases.

1. intext create an account username required email address required blog details inurl register
2. to start connecting please log in first. you can also create an account. .cr. blogs
3. allintext create an account account details profile details blog details yes i d like to create a new blog
4. yes i d like to create a new blog
5. “blog url required ” inurl /register
6. “yes i’d like to create a new blog”
7. intext create an account blog details inurl register
8. to start connecting please log in first. you can also create an account. .be.blogs
9. inurl register yes i d like to create a new blog
10. intext blogs create an account username email address blog details inurl register
11. to start connecting please log in first. you can also create an account. .de.

What I did was I went downloaded the buddypress to my desktop and open every file with NotePad++ and started searching for “create an account; blog details; yes i d like to create a new blog” Once I found those strings, I changed the name to something else and on the registration page I removed the “yes i/d like to create a new blog” along with its checkbox completely and i searched everything with the word “blog” and changed it to something completely different. I Also renamed the “bp-blog.php” and the /bp-blog/ folder.
Make sure to search through the other files in the buddypress folder for anything calling the “bp-blog.php” and the /bp-blogs/ and rename it accordingly.

It has been a week since I done this and I have yet to be spammed. I went from 20 a day to zero overnight by doing this.

You haven’t add Disallow: /? in your robots.txt file.

acpage is the way that BP renders activity pagination to those clients with javascript disabled – such as search engines.

I started a ticket for discussion of technical issues: https://trac.buddypress.org/ticket/3116

You must search for anti-spam plugins that filter out spam activity that the users make.

If the “spammers” are going past the captcha, that means they are not robots, actually people, just spamming your site.

So keep the captcha for robots, and you will need to search for anti-spam software to filter out the spam content posted on your site.

You create a file called robots.txt and you specify which URL so for instance it could be anything after /activity

User-agent: Googlebot
Disallow: /activity/*

This blocks google from scraping your images. This is a MUST for social networks that are using Albums.
User-agent: Googlebot-Image
Disallow: /

@modemlooper, thanks for your suggestion on different forms for different users in the register.php.
I also want to change the register slug. Because spam bots know bp register slug. We can get rid of a lot of them by simply change the register slug. But, how?

@hnla I know that there will be a segment of the population who will be prevented from joining because I am blocking IP addresses. But, I want/need these prevented in the first place and I do not understand why this is not addressed in the core and has to be something I must “hunt through the forum threads to reducing spam signups”. Its not like this is an unknown issue.

Besides, I HAVE searched for “reduce spambots” “reduce fake sign ups” “Reduce and reducing spam sign ups” with zero results.

What I have to ask is “Why?” and “How?” are these spambots accessing and creating users? I have one site that uses WP multisite with BP and there’s a great plugin “BP Registration Options” that works well enough to grab and display all new member requests and displays IP addresses; which I then add to WP-Ban. Its taken a month but I am now down to a dozen or so spambot signups per day.

Now, I have another WP/BP site that is NOT multisite and “BP Registration Options” does not work the same. BUT I copy the IP addresses from the one and paste it into the “WP Ban” of this site. However, I am still 100+ spambot signups per day. So, I have a plugin “Pending Activations” (which doesn’t work in multisite) but this plugin does not display the IP address of the offending spambot signups. Thus, my battle with the signups continues …

So … How are the spambots signing up? Why does the registration form not have CAPTCHA? and how can we stop them from signing up?

“how to disallow bots to follow signup link?”

Put a nofollow, noindex on it, right in the theme where it is linked. And change the default text that is linked. If you look at your access logs and your visitor stats, you’ll see they basically google for you.

@imjscn try hunting for a plugin called KB robots text it allows you to edit the WP robots text from the dashboard and might be handy to have available.

#2 stops bots following the link on other pages, but BP spammers come without a reference page. They know which link is BP register page. I’m not sure if there’s another way for BP.
Jenny this is why I said or mentioned adding a referer trap in .htaccess. Yes bots do link directly so you disallow any direct links that do not contain a referer in the header get request

True search here is a chore

Robots.txt is a file that lives in the root document directory of a site, however I seem to remember issues in the past adding one as WP might be trying to add it’s own one?

What results – if any do you get from running:

http://example.com/robots.txt (your site name obviously)